GHSA-6v67-2wr5-gvf4

ghsaUSosv

QOS.CH logback-core Server-Side Request Forgery vulnerability

view advisory published 2024-12-19Licence: CC-BY-4.0

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-12801US	—	0.23% (13th)	—	2024-12-19
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by c…

references

External citations — patches, advisories, analysis.

https://github.com/qos-ch/logbackPACKAGE
https://github.com/qos-ch/logback/commit/5f05041cba4c4ac0a62748c5c527a2da48999f2dWEB
https://logback.qos.ch/news.html#1.3.15WEB
https://logback.qos.ch/news.html#1.5.13WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-12801ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan